retirement systems of alabama...system of alabama (ers), and judicial retirement fund of alabama...

REQUEST FOR PROPOSALS

FOR

ACTUARIAL AUDITING SERVICES RELATED TO PEER REVIEW OF THE 2016-2020 EXPERIENCE STUDY AND 2020

VALUATIONS

FOR

THE

Retirement Systems of Alabama

RFP 21000000002

Issue Date: January 4, 2021

of 47

THIS RFP CONTAINS INFORMATION UNDER THE FOLLOWING HEADINGS: SECTION I—General Information for the Proposer

A. Purpose B. Background C. Description of the RSA’s Management D. Other Information E. Proposal Opening F. Delivery Schedule G. Payment Schedule H. Selection of Firm I. Economy of Preparation J. News Releases K. Addenda to the RFP L. Contact Point M. Minimum Experience Qualifications N. State of Alabama Contract Requirements O. Confidentiality

SECTION II—Nature of Services Required

A. Purpose B. Required Services

SECTION III-- Information Required from Proposers SECTION IV-- Criteria for Evaluation

A. Evaluation Process B. RSA Rights C. Cost and Price Analysis D. Proposal Evaluation Form E. Proposal Form

SECTION V--Attachments

A. State of Alabama Disclosure Statement (Required by Act 2001-955) B. Contract Shell containing required language of State of Alabama Contracts C. Immigration Compliance Certificate D. RSA Third Party Vendor Security Checklist E. IRS Form W-9 F. Confidentiality and Non-Disclosure Agreement

of 47

SECTION I—GENERAL INFORMATION FOR THE PROPOSER

A. PURPOSE:

REQUEST FOR PROPOSALS: The purpose of this Request for Proposals (RFP) is to solicit proposals from qualified actuarial firms to provide actuarial auditing services to the Retirement Systems of Alabama (RSA), consisting of peer review of the FY2016-2020 Experience Study and a level two actuarial audit of the FY2020 annual actuarial valuation for Teachers’ Retirement System of Alabama (TRS), Employees’ Retirement System of Alabama (ERS), and Judicial Retirement Fund of Alabama (JRF). The successful proposer for this RFP shall be ineligible for appointment to the consulting actuarial engagement for the contract period following the period covered by the 2016-2020 peer review.

B. BACKGROUND: The Teachers' Retirement System, Employees' Retirement System, and Judicial Retirement Fund, collectively referred to as the Retirement Systems of Alabama (RSA or Systems), share certain executive personnel, investment management, accounting, and information system services, the costs of which are allocated to the funds on an equitable basis. The TRS, a cost-sharing multiple-employer public employee retirement plan, was established as of September 15, 1939, pursuant to the Code of Alabama 1975, Title 16, Chapter 25 (Act 419 of the Legislature of 1939) for the purpose of providing retirement allowances and other specified benefits for qualified persons employed by State-supported educational institutions. The responsibility for the general administration and operation of the TRS is vested in its Board of Control. The ERS, an agent-multiple employer public employee retirement plan, was established as of October 1, 1945, pursuant to the Code of Alabama 1975, Title 36, Chapter 27 (Act 515 of the Legislature of 1945). The purpose of the ERS is to provide retirement allowances and other specified benefits for state employees, State Police, and on an elective basis, to all cities, counties, towns, and quasi-public organizations. Assets of the ERS are pooled for investment purposes. However, separate accounts are maintained for each individual employer so that each employer’s share of the pooled assets is legally available to pay the benefits of its employees only. The responsibility for the general administration and operation of the ERS is vested in its Board of Control. The JRF, a cost-sharing multiple-employer public employee retirement plan, was established as of September 18, 1973, pursuant to the Code of Alabama 1975, Title 12, Chapter 18 (Act 1163 of the Legislature of 1973) for the purpose of providing retirement allowances and other specified benefits for any Justice of the Supreme Court of Alabama, Judge of the Court of Civil Appeals, Judge of the Court of Criminal Appeals, Judge of the Circuit Court, or office holder of any newly created judicial office receiving compensation from the State Treasury. The Code of Alabama 1975, Title 12, Chapter 18, Articles 3 & 4 (Act 1205 of the Legislature of 1975) enlarged the scope and coverage of the JRF to include District and Probate Judges, respectively. The responsibility for the general administration and operation of the JRF is vested in the Board of Control of the ERS. State law establishes retirement benefits as well as death and disability benefits and any ad hoc increase in postretirement benefits for the TRS, ERS, and JRF. Benefits for TRS and ERS members

of 47

becoming eligible to receive retirement benefits after 10 years of creditable service. Teachers and state employees who retire after age 60 (52 for State Police) with 10 years or more of creditable service or with 25 years of service (regardless of age) are entitled to an annual retirement benefit, payable monthly for life. Local employees who retire after age 60 with 10 years or more of creditable service or with 25 or 30 years of service (regardless of age), depending on the particular entity’s election, are entitled to an annual retirement benefit, payable monthly for life. Service and disability retirement benefits are based on a guaranteed minimum or a formula method, with the member receiving payment under the method that yields the highest monthly benefit. Under the formula method, members of the TRS and ERS (except State Police) are allowed 2.0125% of their average final compensation (highest 3 of the last 10 years) for each year of service. State Police are allowed 2.875% for each year of State Police service in computing the formula method. Act 377 of the Legislature of 2012 established a new tier of benefits (Tier 2) for members hired on or after January 1, 2013. Tier 2 TRS and ERS members are eligible for retirement after age 62 (56 for State Police) with 10 years or more of creditable service and are entitled to an annual retirement benefit, payable monthly for life. Service and disability retirement benefits are based on a guaranteed minimum or a formula method, with the member receiving payment under the method that yields the highest monthly benefit. Under the formula method, Tier 2 members of the TRS and ERS (except State Police) are allowed 1.65% of their average final compensation (highest 5 of the last 10 years) for each year of service. State Police are allowed 2.375% for each year of state police service in computing the formula method. JRF members become eligible to receive retirement benefits after varying periods set by statute. Except for justices or judges who were either disabled, elected prior to July 30, 1979, or have at least 25 years of creditable service, no justice or judge is eligible to receive judicial service retirement pay prior to attaining age 60. Service retirement benefits for justices and judges are dependent upon the particular office held in the judicial branch of government. A retirement benefit is payable upon the request of any member who has: (1) 25 years of creditable service (regardless of age), (2) completed 12 years of creditable service and has attained age 65, (3) completed 15 years of creditable service and whose age plus service equals or exceeds 77, (4) completed 10 years of creditable service and has attained age 70 or (5) been elected prior to July 30, 1979, and has 18 years of service (regardless of age). A member eligible to retire who has not requested his or her retirement benefit to commence at the end of the term in which the member’s 70th birthday occurs is entitled only to the refund of his or her contributions (except for members with at least 25 years of creditable service). The service retirement benefit for circuit, appellate, and probate judges is 75% of the member’s salary at the time of separation from service. The service retirement benefit for a district judge is 75% of the position’s salary immediately prior to retirement. Covered members of the TRS and ERS (except State Police and certified law enforcement, correctional officers, and firefighters) contributed 5% of earnable compensation to the TRS and ERS as required by statute until September 30, 2011. From October 1, 2011, to September 30, 2012, covered members of the TRS and ERS (except State Police and certified law enforcement, correctional officers, and firefighters) were required by statute to contribute 7.25% of earnable compensation. Effective October 1, 2012, covered members of the TRS and ERS (except State Police and certified law enforcement, correctional officers, and firefighters) are required by statute to contribute 7.50% of earnable compensation. JRF members and certified law enforcement, correctional officers, and firefighters of the TRS and ERS contributed 6% of earnable compensation as required by statute until September 30, 2011. From October 1, 2011, to September 30, 2012, JRF members and certified law enforcement, correctional officers, and firefighters of the TRS and ERS were required by statute to contribute 8.25% of earnable compensation. Effective October 1, 2012, JRF members and certified

of 47

law enforcement, correctional officers, and firefighters of the TRS and ERS are required by statute to contribute 8.50% of earnable compensation. State Police members of the ERS contribute 10% of earnable compensation. ERS local participating employers are not required by statute to increase contribution rates for their members. Tier 2 covered members of the TRS and ERS (except State Police and certified law enforcement, correctional officers, and firefighters) contribute 6% of earnable compensation to the TRS and ERS as required by statute. Tier 2 certified law enforcement, correctional officers, and firefighters of the TRS and ERS are required by statute to contribute 7% of earnable compensation. Tier 2 State Police members of the ERS contribute 10% of earnable compensation. These contribution rates are the same for Tier 2 covered members of ERS local participating employers.

C. DESCRIPTION OF THE RSA’S MANAGEMENT: The TRS and ERS have jointly employed the Secretary-Treasurer as the Chief Executive Officer (CEO) and several other administrative personnel. This has allowed greater efficiencies by consolidating operations of the systems by function. Other information about the Retirement Systems of Alabama can be found at www.rsa-al.gov.

D. OTHER INFORMATION: Documents that are considered as part of this RFP may be located via the Internet as follows: http://www.rsa-al.gov/index.php - RSA home page

1. Retirement Systems of Alabama Comprehensive Annual Financial Report 2. TRS Actuarial Report prepared as of September 30, 2019 3. ERS Actuarial Report prepared as of September 30, 2019 4. JRF Actuarial Report prepared as of September 30, 2019

E. PROPOSAL OPENING:

Please submit one non-redacted electronic copy and one redacted electronic copy to Taylor Benefield at [email protected]. In addition to the electronic copies, please submit six printed copies in a sealed wrapper with the following plainly marked on the front:

ACTUARIAL AUDITING SERVICES RELATED TO PEER REVIEW OF THE 2016-2020 EXPERIENCE STUDY AND 2020 VALUATIONS RFP 21000000002 OPENING February 16, 2021 Proposals will be sent to: Via UPS or FedEx: Via US Mail: Diane E. Scott, CPA Diane E. Scott Chief Financial Officer Chief Financial Officer Retirement Systems of Alabama Retirement Systems of Alabama 201 South Union Street PO Box 302150 Montgomery, Alabama 36104-0001 Montgomery, Alabama 36130-2150

of 47

http://www.rsa-al.gov/

mailto:[email protected]

Proposals may be hand delivered to Room 792 of the Retirement Systems Building, 201 South Union Street, Montgomery, Alabama. Proposals will be accepted until 5:00 p.m. on February 16, 2021and opened at that time. Proposals will not be accepted after this time. The RSA reserves the right to reject any and all responses to this RFP, to waive minor variances in proposals, to modify the RFP or to extend its timeline. Questions related to this RFP may be addressed to Taylor Benefield at [email protected]. Questions must be received by 5:00 p.m., January 11, 2021.

RFP Timetable RFP Issued January 4, 2021 Deadline for receipt of questions January 11, 2021 Issue responses to questions January 18, 2021 Proposals Due February 16, 2021, 5:00 p.m. CST Conduct Finalist Interviews February 22 – 26, 2021 Award Contract March 5, 2021

F. DELIVERY SCHEDULE: The level two actuarial audit of the FY2020 valuations may begin after the contract has been signed by all required signatories and the 2020 valuations have been completed by the Consulting Actuary. A final report must be completed within six weeks. The peer review of the 2016-2020 Experience Study should be completed within six weeks after the Experience Studies are completed by the Consulting Actuary.

G. PAYMENT SCHEDULE: Payment for actuarial auditing services will be made upon the firm’s completion and submission of each written audit report along with a detailed invoice. RSA requires payment terms to be payable 30 days from receipt of invoice.

H. SELECTION OF FIRM: The RSA expects to employ the successful proposer to perform the peer review of the FY2016-2020 Experience Study and level two actuarial audit of the FY2020 valuations. All responding vendors will be notified of RSA’s decision in writing within a reasonable length of time following the selection. Prior to the selection, one or more firms may be requested to make oral presentations to the evaluation committee. All proposals shall become the property of the RSA.

I. ECONOMY OF PREPARATION: Proposals should be prepared simply and economically and provide a concise description of the Proposer’s response to the requirements of this RFP. Emphasis should be on clarity. The RSA will not be responsible for any costs incurred by any Proposer in the preparation of a proposal or in relation to any presentations(s) to the evaluation committee.

of 47


J. NEWS RELEASES: News releases pertaining to this RFP or the actuarial services to which it relates will be made only with prior written approval of RSA’s CEO or his representative.

K. ADDENDA TO THE RFP: RSA reserves the right to modify this RFP in accordance with the provisions contained herein. Any modifications made to the RFP prior to proposal due date will be provided in writing on the RSA website: http://www.rsa-al.gov/index.php/about-rsa/itb-rfp/.

L. CONTACT POINT: Any questions that arise concerning this RFP may be directed to Taylor Benefield at [email protected].

M. MINIMUM EXPERIENCE QUALIFICATIONS: Proposals will be accepted from firms where both the firm and the assigned lead actuarial staff members meet the following minimum experience qualifications:

• The Primary (supervising) actuary must meet the American Academy of Actuaries

Qualification Standards and be a Fellow of the Society of Actuaries (FSA) or an Associate of the Society of Actuaries (ASA).

• The Primary (supervising) actuary should also have significant experience preparing valuations, actuarial audits, peer reviews and other consulting services for public-sector defined benefit retirement plans.

• Performed annual valuations for the most recent three (3) consecutive years of two or more public sector pension plans, each with at least $8 billion in assets and 85,000 or more active and retired members.

• Performed actuarial valuations for at least one of the above clients whereby the statistical data and reports have been included in at least two (2) Comprehensive Annual Financial Reports where the reports received the Certificate of Achievement for Excellence in Financial Reporting from the Government Finance Officers Association

of 47

http://www.rsa-al.gov/index.php/about-rsa/itb-rfp/

N. STATE OF ALABAMA CONTRACT REQUIREMENTS The State of Alabama requires all providers of professional services to submit a Disclosure Statement with each contract. Accordingly, the Disclosure Statement included in Section V of this Request for Proposals (RFP) must be completed and submitted with the proposal. The State of Alabama requires that state agencies and political subdivisions entering into contracts as defined under section 31-13-9(l) have an affirmative duty to insure that the language set out in section 31-13-9(k) is included in each contract and that contractors entering into such contracts provide appropriate verification that they have enrolled in E-Verify and have complied with its requirements. Accordingly, the Immigration Compliance Certificate included in Section V of this Request for Proposals (RFP) must be completed and submitted with each vendor’s proposal. The State of Alabama requires all contracts to contain certain language in a specific format. This language is included in the Contract shell in Section V.

O. CONFIDENTIALITY All material and information received by any proposer, including the successful proposer shall be kept confidential by the proposer(s) unless disclosure is specifically authorized in writing by RSA. Confidential information may not be used by any proposer or successful proposer except in the fulfillment of a contract resulting from the RFP, and must be kept confidential and handled in conformity with all applicable federal and state laws. If access to the plans’ census data is required to complete the work described in this contract, the data must be returned or destroyed within 30 days of the receipt of the related report. RSA must be provided with a certification that this requirement has been fulfilled. Successful Proposer must sign a Non-Disclosure Agreement (NDA) with RSA. See Attached NDA in Section V. Proposals may be subject to disclosure and/or reproduction under Alabama’s open records laws once a contract has been awarded.

of 47

SECTION II—NATURE OF SERVICES REQUIRED

A. Purpose

The purpose of this Request for Proposals (RFP) is to solicit proposals from qualified actuarial firms to provide actuarial auditing services to the Retirement Systems of Alabama (RSA), consisting of peer review of the FY2016-2020 Experience Study and level two actuarial audits of the FY2020 annual actuarial valuation for Teachers’ Retirement System of Alabama (TRS), Employees’ Retirement System of Alabama (ERS), and Judicial Retirement Fund of Alabama (JRF).

B. Required Services

The following services are to be provided:

1. Perform a level two actuarial audit of the TRS, ERS, and JRF actuarial valuations produced by the Consulting Actuary as of September 30, 2020. RSA expects to be able to provide the FY2020 actuarial valuations to the successful proposer by June 1, 2021. The successful proposer will conduct and complete its audit services, including providing all required written analysis and/or reports, within six weeks of receipt of the actuarial valuation.

2. Perform a peer review of the principal economic, demographic and actuarial assumptions used in the experience study reports for the five-year period ending September 30, 2020 for TRS, ERS, and JRF. RSA expects to be able to provide the Five-Year Experience Study for TRS, ERS, and JRF no later than June 30, 2021. The successful proposer will conduct and complete its audit services, including providing all required written analysis and/or reports, within six weeks of receipt of the Experience Studies.

3. Provide up to 10 hours of additional consulting time to RSA to review these audit reports with RSA officials. This additional time shall be included in the fixed fee for each of the audits. Any hours needed beyond 10 shall be charged at the hourly billing rate proposed in the Cost Proposal.

4. Provide a formal report for each of the audits which must summarize the scope, results and conclusions of the Reviewing Actuary. This report shall be presented in person during one of the RSA’s regularly scheduled Board meetings (travel expenses should be included in the fixed fee for each report). The Actuary shall print and submit 35 copies and one electronic copy of the final reports to RSA.

of 47

SECTION III--INFORMATION REQUIRED FROM PROPOSERS

For any Proposal to be considered, the Proposer must submit the following information:

1. Background information of your firm including services it performs, ownership structure, the state in which your firm was formed or incorporated (and whether you are currently in good standing in the state in which you were formed or incorporated), whether your firm is qualified to transact business in the State of Alabama (and, if so, whether the firm is in good standing in Alabama), the size of your firm and the location of the staff that will perform the services. Discuss in detail the services your firm performs relative to the services required of this RFP.

2. Describe any material changes in organization structure or ownership that have occurred in the past five years.

3. Describe any recent or planned changes to the ownership or organization structure. Disclose any anticipated assignment of a contract resulting from this RFP.

4. Provide an organization chart that depicts the structure of the actuarial consulting group and that identifies this group’s key members and the members who will be involved in providing direct services to RSA.

5. Describe the firm’s objectives with respect to future growth. What products/services will be emphasized or de-emphasized in the future? What are the firm’s expectations for its products, and how does it plan to manage the future growth of these products? Discuss how the firm plans to make sure that future growth does not compromise the quality of your existing actuarial consulting services. Include in your answer how you plan to manage growth in your client/actuarial consultant ratio.

6. Discuss in general the firm’s competitive advantage over other firms in the actuarial consulting industry and in the actuarial audit service area. Why should RSA hire your firm?

7. Has your firm or any actuary you employ, within the last ten years, been censured or fined by any judicial, governmental, or regulatory body? If so, please indicate the dates and describe the situation.

8. Is the firm affiliated with any other firm(s) offering non-actuarial services that could represent conflicts of interest? If yes, briefly describe your firm’s policies and procedures for doing business with these affiliates while safeguarding against conflicts of interest.

9. Do you, your parent company, or any affiliated company have any business relationships with Cavanaugh Macdonald Consulting? If so, describe that relationship.

10. List and describe any professional relationship your firm or any of your actuarial consulting group staff have with any member of the RSA Boards (TRS, ERS, JRF), RSA staff, or participating employers in TRS, ERS, or JRF.

of 47

11. How many actuaries does your firm employ?

12. For the key executives and professionals in the actuarial consulting group, including the

Primary (supervising) Actuary and all Secondary Actuaries that would be assigned to RSA, provide a table that identifies the following information:

a. Name b. Title c. Responsibilities within the firm. If a person has multiple responsibilities,

indicate the percentage of time spent on each function d. Years of relevant experience e. Years with the firm f. Degrees and professional designations g. Institution awarding each degree and designation h. Publications authored

13. How long has the current group of key executives and professionals in your

actuarial consulting group been together?

14. For the Primary Actuary and all Secondary Actuaries, state the length of time these individuals have all worked together as a team.

15. For the Primary Actuary and all Secondary Actuaries, list their actuarial audit assignments for the past three years. Include for each assignment the date of the final audit report, whether the Actuary served as the primary or secondary Actuary, and the client’s name and size (number of pension plan members and retirants).

16. For the Primary Actuary and all Secondary Actuaries that will directly provide services to RSA, state the role each would play in providing the required RSA services.

17. State for the Primary Actuary and each Secondary Actuary the total number of clients currently assigned to these individuals; describe whether the assignment is for general actuarial services or actuarial audit services.

18. Discuss the causes and impact of any executive and professional staff turnover (departures or hiring/promotions) in the actuarial consulting group that has occurred in the last five years. Provide a table listing all of the professionals that have departed from that group over the past five years. For each individual, provide the following information:

a. Date of departure b. Name c. Title d. Responsibilities e. Years with the firm f. Reason for leaving g. Name of replacement

19. Does the firm have a transition plan to deal with the possible sudden departure of key

professionals within the group? Describe the plan.

of 47

20. Describe the specific methodology to be used for the required scope of services identified in Section II of this RFP.

21. Provide a timeline for completion of the work identified in Section II of this RFP. Include proposed dates for each key stage or event of the project, indicate dates by which your firm must have specific input data from RSA or its consulting actuary, and indicate points in the project when your firm would plan to meet with RSA staff at our office or via conference call.

22. Describe your firm’s theory and methodology used in recommending an appropriate actuarial cost method for a public pension fund.

23. Describe your firm’s theory and methodology for development of actuarial assumptions (except for the interest rate assumption, which is addressed separately).

24. Describe the methodology you use to formulate a pension fund’s actuarial interest rate assumption. How may this methodology differ from client to client? Under what circumstances would you recommend TRS, ERS, and JRF change their interest rate assumption?

25. Describe your firm’s approach to recommendations regarding the amortization of unfunded liabilities.

26. Describe your approach to measuring funded status and funding progress in order to facilitate the assessment of trends over several valuations of a client.

27. Describe the capabilities of your valuation system(s) and your computer system support.

28. Describe your quality control processes for actuarial audit reports and recommendations. How are these services monitored and reviewed?

29. Provide as Appendix A one recent actuarial audit report as provided to an existing client for a cost sharing plan and one for an agent-multiple employer plan.

30. For the last five years provide the following data relating to client relationships where actuarial auditing services similar to the services required by this RFP have been or are being provided:

a. Total number of actuarial audit clients b. Total number of public pension plan actuarial audit clients c. Total number of public pension plan actuarial audit clients with a cost

sharing plan d. Total number of public pension plan actuarial audit clients with an agent-

multiple employer plan

31. For all current public pension plan clients, state the client’s name, the first year of your initial Contract with the plan, year end of the last valuation your firm completed and their asset and membership size as of the date of the last valuation completed. Designate by asterisk which of these clients are agent multiple-employer plans and provide number of participating employers.

of 47

32. Provide the name, title, address, and telephone number for the following six client references for whom your firm has provided either full service actuarial consulting or actuarial audit services similar to this RFP, as specified in each question:

a. The client for whom your firm most recently completed an actuarial audit. b. The client that most recently terminated your firm’s full-service actuarial

consulting contract. c. The client with the longest full-service actuarial consulting relationship with your

firm. d. A multi-employer public pension plan client for whom your firm has provided full-

service actuarial consulting for at least three years. e. A full-service actuarial consulting client that has been assigned for at least two years

to the Primary Actuary proposed for the RSA account. f. The client for whom the Primary Actuary most recently completed an actuarial audit.

33. List all pension plan clients that have terminated their actuarial service contracts with

your firm in the last five years. Include the client firm’s name, size (number of pension plan members and retirants), date of contract termination, and reason(s) for contract termination.

34. Within the last five years, has your firm been notified by any actuarial consulting services client that your firm is in default of its contract, or that conditions exist endangering continuation of that contract? If so, state the client firm’s name, year the notice was received, reasons for the notice, and resolution or current status of the relationship.

35. Provide the names of all public pension plan clients for whom you have performed actuarial audits within the last five years.

36. Have your firm’s actuarial consulting service products been audited by another actuarial firm within the last five years? If so, state the number of such audits and whether any resulted in revisions to your clients’ annual valuation results, actuarial assumptions, or actuarial cost methods.

37. Would your firm propose to use any subcontracts in the provision of the required RSA services? If so, describe the specific services that would be subcontracted, the name of the subcontractor, the cost to your firm of these services, and how you would control the quality of services provided.

38. What investments has the firm made in information technology?

39. What are your plans/arrangements in place for alternative work sites should either your headquarters facility or the facility that will primarily provide services to RSA become inoperative because of fire, earthquake, etc.? Briefly describe your organization’s response for the work environment related to COVID-19. Briefly describe your emergency and disaster recovery plans. Include in your description your disaster recovery plans related to client data files.

40. How does the firm monitor and measure actuarial client satisfaction and actuarial audit satisfaction?

of 47

41. Discuss how the firm controls costs, quality, timeliness and confidentiality of its services, specifically the services required by this RFP.

42. Describe the resources your firm has that specifically address the needs of public pension fund clients.

43. Describe how fees are determined for your firm’s actuarial auditing services.

44. The proposed fee should include administrative, third-party, travel, and all other costs. Please provide a statement that you understand this and that these have been included in the cost of the proposal.

45. Disclose any disciplinary action or litigation taken against the firm or any member of the firm’s staff regarding the provision of professional services. Disclose any felony convictions within the last five years of any members of the firm’s professional staff. Disclose any bankruptcy filings of assignments for the benefit of creditors by or against the firm within the last five years.

46. Provide positive statement that the firm and assigned actuaries for this project have met each of the minimum qualifications set forth in Section I. M.

47. Provide resumes for the key personnel who will be assigned to this engagement.

48. Provide discussion that provides evidence of the Proposer’s knowledge of the state, regional, and national public pension plan market.

49. In Section V of this RFP is a Contract Shell which includes contract terms required in all State of Alabama contracts. Review this contract shell and provide an affirmative statement that proposer will agree to the requirements for all State of Alabama contracts. In the event there are any provisions to which proposer does not agree, please provide proposed language. The acceptance by RSA of a proposal does not under any circumstances constitute an agreement by RSA to any terms provided by such proposer under this item.

50. In Section V of this RFP is a Non-Disclosure Agreement. Review this NDA and provide an affirmative statement that proposer will agree to sign the NDA upon contract award. In the event there are any provisions to which proposer does not agree, please provide proposed language.

51. Please provide any agreements or requirements proposer desires that RSA enter into. By accepting proposer’s proposal, RSA is not agreeing to and accepting any terms provided by proposer under this item. In addition, the provision of any agreements or requirements under this item does not satisfy the requirement that proposers explicitly state any and all exceptions to RSA’s proposal specifications or contract terms.

52. The cost proposal and technical proposal must be submitted in separate and clearly labeled envelopes. Please affirm your understanding of this requirement.

53. Completion of the Proposal Form in Section IV. This cost will be used to determine the cost portion of the proposal’s score.

of 47

54. The following additional forms must be completed and returned with proposal:

a. Vendor Disclosure Form b. IRS Form W-9 c. Immigration Compliance Certificate d. E-Verify Memorandum of Understanding issued and electronically signed by the U. S.

Department of Homeland Security (note that the FEIN on the W-9 must agree with the FEIN listed on the E-Verify Memorandum)—the entire MOU should be provided

e. RSA Third Party Vendor Security Checklist

55. Include the names, e-mail addresses and telephone numbers of personnel of your organization authorized to execute the proposed contracts with the RSA.

56. Confirm your firm’s ability to obtain and maintain, with respect to the activities in which your firm engages pursuant to any agreement that may result from this RFP, professional liability (errors and omissions) insurance, general liability insurance and cyber security insurance in amounts reasonable and customary for the nature and scope of such engagement.

57. The Proposer must affirm that it has read and understands the RFP and the terms and conditions included in the RFP. The Proposer must state any and all exceptions it takes with the requirements set forth in the RFP and/or with any terms and conditions contained in the RFP relating to the ensuing contract. Only the exceptions identified in this section of the proposal will be considered by RSA; any other exceptions embedded elsewhere in the proposal will not be recognized by RSA.

58. Include any other information believed to be pertinent but not specifically requested elsewhere in this RFP.

of 47

Section IV—Criteria for Evaluation

A. EVALUATION PROCESS

The following process will be used to evaluate vendor proposals: a. A review committee will evaluate each proposal submitted in response to these

Proposal specifications. b. Responses received within the time frame and in the form specified by the guidelines

will first be evaluated to confirm that all proposal sections, as detailed, have been provided in the Proposal response.

c. Each proposal will be reviewed and points awarded to all items indicated on the Proposal Evaluation Form. Any proposal component may be awarded points not to exceed the maximum specified on the Proposal Evaluation Form. The total technical score available is 70 points.

d. Each proposal component will be summed to obtain a total score. e. RSA may, at its sole discretion, conduct an interview with the finalists.

B. RSA’s RIGHTS Proposers should note that RSA reserves the right to modify this evaluation structure if it is deemed necessary or request additional information from vendors. It is the intention of RSA to select the most qualified and cost-effective proposal based on the evaluation of the Proposer’s responses to this RFP. However, RSA reserves the right to ask vendors for additional information and/or an oral presentation to clarify their proposals. RSA also reserves the right to cancel or terminate the RFP or reject any or all proposals received in response to this RFP.

C. COST AND PRICE ANALYSIS: The cost evaluation will be based on examination by the Evaluation Committee of each Proposer’s stated cost components, and will constitute 30% of the overall proposal’s evaluation. The preparation of the peer review and audit reports should be a fixed price. Billing is to be submitted with the detail by staff member of hours worked on each task. The total paid to the selected vendor for the required peer review and audit reports will not exceed the proposed cost unless both parties agree in writing. Cost scoring will be determined as follows:

a. Cost proposals must be provided in a separate envelope clearly labeled, “Cost Proposal”.

b. The Proposer submitting the lowest cost Proposal will receive 30 points. c. All other Proposers will be evaluated by use of the following formula:

Lowest Cost of All Proposals Proposer’s Score for Cost Cost of Proposal Under Evaluation X 30 points = of Audits

of 47

NOTE: The RSA will not be liable for any expense for use of any job classification by the proposer that is not identified in the proposer’s response.

D. PROPOSAL EVALUATION FORM

General Proposal Categories Possible Points

Reviewer’s Score

Description of Services to be Performed 10 Experience with Similar Proposals 25 Experience of Personnel Assigned 20 IT Risk 5 Methodology and Ability to Meet Timeline 10 Total Technical Score 70 Cost Proposal 30 Total Possible Points 100 Finalist Interviews (optional) 10

Proposers must respond to all required components of the RFP.

E. PROPOSAL FORM

Name of Proposing Firm:

Task Total Estimated Hours Total Proposed Cost

Actuarial Audits including an additional 10 hrs consulting

Hourly Rates and Projected Work Distribution for Assigned Staff related to actuarial audits

Staff Level Hourly Rate Projected Distribution Partner/Principal/Primary Actuary $ Senior/Secondary Actuary $ Staff Actuary $ Administrative Staff $ Total N/A 100%

Weighted Average Cost of Consulting Hours

Ancillary expenses (travel, meals, lodging, etc.) are to be included in the proposed hourly rates. Hourly Rate for consulting hours greater than 10: The proposed cost of the actuarial audits

includes an additional 10 hours of consulting. Proposer should propose an hourly rate to be charged for consulting that exceeds the 10 hours included in the fixed price of the audits.

Proposed Hourly Rate: $___________________________________

of 47

SECTION V—Attachments

A. State of Alabama Disclosure Statement (Required by Act 2001-955) B. Contract Shell containing required language of State of Alabama Contracts. C. Immigration Compliance Certificate D. RSA Third Party Vendor Security Checklist E. IRS Form W-9 F. Confidentiality and Non-Disclosure Agreement

of 47

State of Alabama Disclosure Statement

(Required by Act 2001-955)

ENTITY COMPLETING FORM

ADDRESS

CITY, STATE, ZIP TELEPHONE NUMBER

( ) STATE AGENCY/DEPARTMENT THAT WILL RECEIVE GOODS, SERVICES, OR IS RESPONSIBLE FOR GRANT AWARD

ADDRESS

CITY, STATE, ZIP TELEPHONE NUMBER

( )

This form is provided with:

Contract Proposal Request for Proposal Invitation to Bid Grant Proposal

Have you or any of your partners, divisions, or any related business units previously performed work or provided goods to any State Agency/Department in the current or last fiscal year?

Yes No

If yes, identify below the State Agency/Department that received the goods or services, the type(s) of goods or services previously provided, and the amount received for the provision of such goods or services.

STATE AGENCY/DEPARTMENT TYPE OF GOODS/SERVICES AMOUNT RECEIVED

Have you or any of your partners, divisions, or any related business units previously applied and received any grants from an y State Agency/Department in the current or last fiscal year?

Yes No

If yes, identify the State Agency/Department that awarded the grant, the date such grant was awarded, and the amount of the grant.

STATE AGENCY/DEPARTMENT DATE GRANT AWARDED AMOUNT OF GRANT

1. List below the name(s) and address(es) of all public officials/public employees with whom you, members of your immediate family, or any of your employees have a family relationship and who may directly personally benefit financially from the proposed transaction. Identify the State Department/Agency for which the public officials/public employees work. (Attach additional sheets if necessary.)

NAME OF PUBLIC OFFICIAL/EMPLOYEE ADDRESS STATE DEPARTMENT/AGENCY

OVER of 47

2. List below the name(s) and address(es) of all family members of public officials/public employees with whom you, members of your immediate family, or any of your employees have a family relationship and who may directly personally benefit financially fro m the proposed transaction. Identify the public officials/public employees and State Department/Agency for which the public officials/public employees work. (Attach additional sheets if necessary.)

NAME OF NAME OF PUBLIC OFFICIAL/ STATE DEPARTMENT/ FAMILY MEMBER ADDRESS PUBLIC EMPLOYEE AGENCY WHERE EMPLOYED

If you identified individuals in items one and/or two above, describe in detail below the direct financial benefit to be gained by the public officials, public employees, and/or their family members as the result of the contract, proposal, request for proposal, invitation to bid, or grant proposal. (Attach additional sheets if necessary.)

Describe in detail below any indirect financial benefits to be gained by any public official, public employee, and/or family members of the public official or public employee as the result of the contract, proposal, request for proposal, invitation to bid, or grant proposal. (Attach additional sheets if necessary.)

List below the name(s) and address(es) of all paid consultants and/or lobbyists utilized to obtain the contract, proposal, request for proposal, invitation to bid, or grant proposal:

NAME OF PAID CONSULTANT/LOBBYIST ADDRESS

By signing below, I certify under oath and penalty of perjury that all statements on or attached to this form are true and correct to the best of my knowledge. I further understand that a civil penalty of ten percent (10%) of the amount of the transaction, not to exceed $10,000.00, is applied for knowingly providing incorrect or misleading information.

Signature Date

Notary’s Signature Date Date Notary Expires

Act 2001-955 requires the disclosure statement to be completed and filed with all proposals, bids, contracts, or grant proposals to th e State of Alabama in excess of $5,000.

of 47

AGREEMENT TO PROVIDE <<PROFESSIONAL>> SERVICES DATED <<______>> P A G E | 1

STATE OF ALABAMA

MONTGOMERY COUNTY

<<SAMPLE>> AGREEMENT TO PROVIDE <<PROFESSIONAL>> SERVICES

THIS AGREEMENT TO PROVIDE <<PROFESSIONAL>> SERVICES (THE “AGREEMENT”), which results from RFP <<___-

__________>> entitled Request for Proposal for <<Professional>> Services, is made and entered into

effective <<_____________, 2018>>, by and between the <<Teachers’ Retirement System of Alabama and

the Employees’ Retirement System of Alabama, collectively the Retirement Systems of Alabama (“RSA”)

/// Public Education Employees’ Health Insurance Board, on behalf of the Public Education Employees’

Health Insurance Plan of Alabama (“PEEHIP”)>>, and <<Insert Contractor Name>>, hereinafter referred to

as “Contractor”.

Recitals

A. <<To be drafted based upon RFP, Proposal, and services required>>.

B. The parties wish to enter into this Agreement to formalize the terms under which Contractor will

provide the services.

NOW, THEREFORE, in consideration of the foregoing and the mutual covenants of the parties contained

herein, the receipt and sufficiency of which are acknowledged, the parties agree as follows:

1. SCOPE OF SERVICES. Upon request of <<RSA/PEEHIP>>, Contractor shall perform the following

services for <<RSA/PEEHIP>> (“Services”):

a. <<To be drafted based upon RFP, Proposal, and services required>>.

b.

2. CONSIDERATION. As consideration for the services rendered pursuant to this Agreement,

<<RSA/PEEHIP>> agrees to compensate Contractor in accordance with the rates and fees set forth in

Exhibit A, which is attached hereto and incorporated herein by reference.

Contractor shall send monthly detailed invoice(s) for all work in arrears. <<RSA/PEEHIP>> shall have thirty

(30) days from receipt of an invoice from Contractor to render payment. Should <<RSA/PEEHIP>> dispute

any invoiced amount, <<RSA/PEEHIP>> must deliver within thirty (30) days of receipt of invoice written

notice to Contractor detailing the specific facts and circumstances of the dispute and shall timely pay all

undisputed amounts. The parties agree to work together in good faith to resolve any disputed amounts.

The maximum compensation due to Contractor during the term of this Agreement shall not exceed

$_______________________________.

3. TERM. This Agreement shall be for the period beginning <<_______>> and ending

<<_________>>. <<Depending upon RFP, possibly insert….The parties may, by mutual written consent,

renew this Agreement for <<insert #>> additional one year terms upon the same terms and at the same

fees contained herein>>.

4. APPROVALS. Contractor acknowledges and understands that this Agreement is not effective until

it has received all required state government approvals, and Contractor shall not begin performing work

of 47


under this Agreement until notified to do so by <<RSA/PEEHIP>>. Contractor is entitled to no

compensation for work performed prior to the effective date of this Agreement.

5. INDEPENDENT CONTRACTORS. Contractor acknowledges that Contractor is an independent

contractor, and neither Contractor nor Contractor’s employees are to be considered employees of

<<RSA/PEEHIP>> or entitled to benefits under the State of Alabama merit system.

6. NO STATE DEBT, ETC. Contractor acknowledges that the terms and commitments contained herein

shall not be constituted as a debt of the State of Alabama in violation of Article 11, Section 213 of the

Constitution of Alabama, 1901, as amended by Amendment Number 26. It is further agreed that if any

provisions of this Agreement shall contravene any statute or Constitutional provision or amendment,

either now in effect or which may, during the course of this Agreement, be enacted, then that conflicting

provision in the Agreement shall be deemed null and void and the remaining provisions shall continue to

be valid and enforceable. Contractor may not assign this Agreement or any interest herein or any money

due hereunder without the expressed written consent of <<RSA/PEEHIP>>. Contractor’s sole remedy for

the settlement of any and all disputes arising under the terms of this Agreement shall be limited to the

filing of a claim with the Board of Adjustment of the State of Alabama.

In the event of proration of the funds from which this Agreement is to be paid, the Agreement will be

subject to termination by <<RSA/PEEHIP>>.

7. INDEMNIFICATION. To the fullest extent permitted by law, Contractor shall indemnify, defend, and

hold harmless <<RSA/PEEHIP>>, its administrators, officers, directors, agents and employees (the

“Indemnitees”), from and against any and all claims, damages, losses, and expenses, including but not

limited to reasonable attorney’s fees, arising out of or resulting from Contractor’s performance of services

under this Agreement and/or any other of Contractor’s acts and/or omissions under this Agreement.

Contractor acknowledges and agrees that, notwithstanding anything to the contrary contained herein or

in any other agreement between the parties hereto, <<RSA/PEEHIP>> shall not indemnify or hold harmless

Contractor, its affiliates, administrators, officers, employees or agents. Contractor further acknowledges

and agrees that <<RSA/PEEHIP>> shall not be liable to Contractor for any late fees, penalties, collection

fees or attorney fees unless specifically agreed to in a writing signed by <<RSA/PEEHIP>>.

8. INSURANCE. Contractor agrees that Contractor shall maintain or obtain (as applicable), with

respect to the activities in which Contractor engages pursuant to any Agreement that results from this

RFP, general liability insurance and cyber security insurance in amounts reasonable and customary for the

nature and scope of business engaged in by such party. <<With certain services, specific limits and

additional requirements will be inserted>>. The foregoing coverages shall be maintained without

interruption for the entire term of this Agreement. Contractor shall deliver to <<RSA/PEEHIP>> evidence

of such insurance on or before the date the Agreement goes into effect and annually thereafter.

<<RSA/PEEHIP>> reserves the right to require additional insurance coverage than listed herein as

<<RSA/PEEHIP>> deems appropriate with a thirty day notice to Contractor.

Contractor must provide at least thirty days (10 days in the event of cancellation due to non-payment of

premium) prior notice of any cancellation, non-renewal or material change to any insurance policy

covered by this Agreement. If any such notice is given, <<RSA/PEEHIP>> shall have the right to require

of 47


that a substitute policy (ies) be obtained prior to cancellation and replacement Certificate(s) of Insurance

shall be provided to <<RSA/PEEHIP>>.

9. CONFIDENTIALITY AND OWNERSHIP. Contractor acknowledges that, in the course of performing its

responsibilities under this Agreement, Contractor may be exposed to or acquire information that is

proprietary or confidential to <<RSA/PEEHIP>> or the companies in which it invests. Contractor agrees to

hold such information in confidence and not to copy, reproduce, sell, assign, license, market, transfer or

otherwise disclose such information to third parties or to use such information for any purpose

whatsoever, without the express written permission of <<RSA/PEEHIP>>, other than for the performance

of obligations hereunder or as required by applicable state or federal law. For purposes of this Agreement,

all records, financial information, specifications and data disclosed to Contractor during the term of this

Agreement, whether submitted orally, in writing, or by any other media, shall be deemed to be

confidential in nature unless otherwise specifically stated in writing by <<RSA/PEEHIP>>.

Contractor acknowledges that all data relating to <<RSA//PEEHIP>> is owned by <<RSA/PEEHIP>> and

constitutes valuable property of <<RSA/PEEHIP>>. <<RSA/PEEHIP>> shall retain ownership of, and all

other rights and interests with respect to, its data (including, without limitation, the content thereof, and

any and all copies, modifications, alterations, and enhancements thereto, and any derivative works

resulting therefrom), and nothing herein shall be construed as granting Contractor any ownership, license

or any other rights of any nature with respect thereto. Contractor may not use <<RSA/PEEHIP>>’s data

(including de-identified data) for any purpose other than providing the Services contemplated hereunder.

Upon termination of the Agreement, Contractor agrees to return or destroy all copies of <<RSA/PEEHIP>>

data in its possession or control except to the extent such data must be retained pursuant to applicable

law.

10. STATE IMMIGRATION LAW COMPLIANCE. By signing this Agreement, the contracting parties affirm, for

the duration of the Agreement, that they will not violate federal immigration law or knowingly employ,

hire for employment, or continue to employ an unauthorized alien within the State of Alabama.

Furthermore, a contracting party found to be in violation of this provision shall be deemed in breach of

the Agreement and shall be responsible for all damages resulting therefrom.

11. BOYCOTT PROHIBITION. In compliance with Act 2016-312, Contractor hereby certifies that it is not

currently engaged in, and will not engage in, the boycott of a person or an entity based in or doing business

with a jurisdiction with which this state can enjoy open trade.

12. DISPUTE RESOLUTION. For any and all disputes arising under the terms of this contract, the parties

hereto agree, in compliance with the recommendations of the Governor and Attorney General, when

considering settlement of such disputes, to utilize appropriate forms of non-binding alternate dispute

resolution including, but not limited to, mediation by and through the Attorney General’s Office of

Administrative hearings or where appropriate, private mediators.

13. OPEN RECORDS LAW COMPLIANCE. Contractor acknowledges that <<RSA/PEEHIP>> may be subject

to Alabama open records laws or similar state and/or federal laws relating to disclosure of public records

and may be required, upon request, to disclose certain records and information covered by and not

exempted from such laws. Contractor acknowledges and agrees that <<RSA/PEEHIP>> may comply with

those laws without violating any provision of Contractor’s proposal or this final Agreement. Contractor

agrees to intervene in and defend any lawsuit brought against <<RSA/PEEHIP>> or any of its employees,

of 47


agents or directors, for their refusal to provide Contractor’s alleged confidential and/or proprietary

information to a requesting party. <<RSA/PEEHIP>> shall provide Contractor written notice of any such

lawsuit within ten (10) days of receipt of service. Contractor shall intervene within thirty (30) days of

notice or will be deemed to have waived any and all claim that the information is confidential and/or

proprietary and any and all claims against <<RSA/PEEHIP>> for disclosure of Contractor’s alleged

confidential and/or proprietary information.

14. APPLICABLE LAW. This Agreement shall be governed by and construed in accordance with Alabama

law, without giving any effect to the conflict of laws provision thereof.

15. TERMINATION.

TERMINATION FOR CONVENIENCE: This Agreement may be terminated for any reason by either party

with the submission of a thirty (30) day written notice thereof.

TERMINATION FOR DEFAULT: <<RSA/PEEHIP>> may terminate immediately all or any part of this

Agreement, by giving notice of default by Contractor, if the Contractor (1) refuses or fails to deliver the

goods or services within the time specified, (2) fails to comply with any of the provisions of the Agreement

or so fails to make progress as to endanger or hinder performance, (3) becomes insolvent or subject to

proceedings under any law relating to bankruptcy, insolvency, or relief of debtors. In the event of

termination for default, <<RSA/PEEHIP>>’s liability will be limited to the payment for goods and/or

services delivered and accepted as of the date of termination.

16. ENTIRE AGREEMENT. It is understood by the parties that this instrument, including its exhibit(s),

contains the entire agreement of the parties with respect to matters contained herein; provided that the

parties may choose to enter into letters of engagement periodically during the term of this agreement to

more specifically delineate the parameters of the services. In such event, the order of precedence will be

this contract first and then the letters.

<<17. ADDITIONAL CLAUSES AND SAMPLE CONTRACT CLAUSE DISCLAIMER. This form Agreement contains

certain non-negotiable mandatory state law clauses as well as offers a starting point for negotiation of

additional clauses and is included for the purpose of allowing proposers to an RFP to be aware of the

foregoing clauses prior to submitting a proposal. RSA/PEEHIP reserves the right to change any of the

clauses contained herein or insert additional clauses before sending a draft copy of the Agreement to

Contractor.>>

IN WITNESS WHEREOF, the parties have executed this Agreement effective as of the date first provided

above.

__________________ Contractor’s Federal Tax ID Number

Conduent HR Consulting, LLC

By: ______________________________

<<RSA/PEEHIP>> By: David G. Bronner

of 47


Its: ______________________________ Its: <<Secretary-Treasurer/Chief Executive Officer>>

Legally Reviewed and Approved by:

Legal Counsel for <<RSA/PEEHIP>>

Approved:

Governor Kay Ivey State of Alabama

of 47


EXHIBIT A

CONSIDERATION

<<RSA/PEEHIP>> shall pay to Contractor the following fees in accordance with the terms more specifically

set forth in the Agreement:

of 47

State of _____________________

County of ____________________

CERTIFICATE OF COMPLIANCE WITH THE BEASON-HAMMON ALABAMA TAXPAYER AND CITIZEN PROTECTION ACT

(ACT 2011-535, as amended by ACT 2012-491)

DATE: _________________________

RE: Contract/Grant/Incentive (describe by number or subject): _______________________________________________ by and between

___________________________________________________________________________________________ (Contractor/Grantee) and

______________________________________________________________________________ (State Agency, Department of Public Entity)

The undersigned herby certifies to the State of Alabama as follows:

1. The undersigned holds the position of _______________________________with the Contractor/Grantee named above, and is authorized to

provide representations set out in this Certificate as the official and binding act of that entity, and has knowledge of the provisions of THE

BEASON-HAMMON ALABAMA TAXPAYER AND CITIZEN PROTECTION ACT (ACT 2011-535 of the Alabama Legislature, as

amended by Act 2012-491) which is described herein as “the Act”.

2. Using the following definitions from Section 3 of the Act, select and initial either (a) or (b), below, to describe the Contractor/Grantee’s

business structure.

BUSINESS ENTITY: Any person or group of persons employing one or more persons performing or engaging in any activity,

enterprise, profession, or occupation for gain, benefit, advantage, or livelihood, whether for profit or not for profit. “Business entity”

shall include, but not be limited to the following:

a. Self-employed individuals, business entities filing articles of incorporation, partnerships, limited partnerships, limited liability

companies, foreign corporations, foreign limited partnerships, foreign limited liability companies authorized to transact business

in this state, business trusts, and any business entity that registers with the Secretary of State.

b. Any business entity that possesses a business license, permit, certificate, approval, registration, charter, or similar form of

authorization issued by the state, any business entity that is exempt by law from obtaining such a business license and any

business entity that is operating unlawfully without a business license.

EMPLOYER: Any person, firm, corporation, partnership, joint stock association, agent, manager, representative, foreman, or other

person having control or custody of any employment, place of employment, or of any employee, including any person or entity

employing any person for hire within the State of Alabama, including a public employer. This term shall not include the occupant of a

household contracting with another person to perform casual domestic labor within the household.

___(a) the Contractor/grantee is a business entity or employer as those terms are defined in Section 3 of the Act. The Contractor/Grantee must

attach a copy of its complete E-Verify Memorandum of Understanding issued and electronically signed by the U.S. Department of

Homeland Security when the business entity or employer enrolls in the E-Verify program to this Certificate of Compliance.

___(b) The Contractor/Grantee is not a business entity or employer as those terms are defined in Section 3 of the Act.

3. As of the date of this Certificate, Contractor/Grantee does not knowingly employ an unauthorized alien within the State of Alabama and

hereafter it will not knowingly employ, hire for employment, or continue to employ an unauthorized alien within the State of Alabama;

4. Contractor/Grantee is enrolled in E-verify unless it is not eligible to enroll because of the rules of that program or other factor beyond its

control.

Certified this______day of ______________20 ___. Name of Contractor/Grantee/Recipient

By:

Its:

The above Certification was signed in my presence by the person whose name appears above, on

This________day of _________________________20______.

WITNESS__________________________________

__________________________________

Printed Name of Witness

of 47

Proposer Name:

Prepared By:

I. Security Policy YES/NO/NA Comments

1Is there a corporate information security policy in place? If yes, provide

as an attachment.

2Does the policy state what is and is not permissible as it pertains to

sensitive company and customer information?

3Does the policy identify what is classified as sensitive company and

customer information?

4Does the policy identify management and employee responsibilities

including contractors?

5Does the policy identify use of employee owned devices such as laptops,

smart phones, and any other form of device capable of storing data?

6 Does the policy address change management requirements?

7 Is there a policy on the portable media?(e.g., thumb drives, CDRW, etc.)

8

Are personnel and contract personnel required to have national

background check performed as part of your security policy? Please

provide a copy of Proposers personnel policy if this is separate

addressing hiring and termination procedures.

1 Are procedures in place to implement the information security policy?

2Are the procedures and standards evaluated to determine their level of

impact to the business process?

3Does the project management methodology uphold the security

practices? If yes, explain how.

B. Procedures

Date:

Title:

RSA Third Party Vendor - Security Questionaire

Factors:

A. Policy

Page 1 of 12 of 47

4Are there policy and procedures in place to vet and audit subcontractors

prior to contract acceptance where applicable?

1 Is there a reasonable and usable information classification policy?

2Does the information classification policy address all enterprise

information?

3Is an information classification methodology in place to assist employees

in identifying levels of information within the business unit?

4Is there an information handling matrix that explains how specific

information resources are to be handled?

II. Corporate Practices

A. Organizational Suitability

1The Information Security Program has an executive level committee

assigned for reporting and guidance purposes?

2Are employees able to perform their duties efficiently and effectively

while following security procedures?

3Does the information security program have its' own line item in the

budget?

4Does the security group have the authority to submit needed security

policy changes throughout the enterprise?

5Is an annual report on the level of information security compliance

issued to management?

6Is there more than one person responsible for the implementation of the

Information Security Program?

B. Personnel Issues

1Are employees able to work less than a 50 hour work week on a monthly

average and complete their assignments?

2Are employees and project managers aware of their responsibilities for

protecting information resources via written policy?

3 Are technical employees formally trained to perform their tasks?

4 Are contract personnel subject to confidentiality agreements?

5 Are contract personnel subject to the same policies employees are?

C. Document Handling

Page 2 of 12 of 47

6Is access to sensitive/confidential information by contract personnel

monitored?

7Are national background checks performed on all proposing party

employees?

8Is a similar screening process carried out for contractors and temporary

staff?

9

Does employment application ask if the prospective employee has ever

been convicted of a crime? If so, does proposing firm employee

individuals with felony convictions?

10 Are prior employment verifications performed for initial employment?

11

Are there any current or pending litigations against staff, former staff, or

contract staff regarding coporate espianage, identity theft, or any other

areas regarding the security of privacy of confidential information?

C. Training and Education

1Do employees receive security related training specific to their

responsibilities? If yes, please attach a sample.

2Are employees receiving both positive and negative feedback related to

security on their performance evaluations?

3Is security-related training provided periodically to reflect changes and

new methods?

4Are system administrators given additional security training specific to

their jobs?

5Have employees undergone a HIPAA training class for those handling

personal health information (PHI)?

D. Oversight and Auditing

1Is Proposer at minimum AICPA SOC 1 Type 2 compliant for financial

reporting. If so, please provide the SOC report(s).

2Is Proposer's datacenter AICPA SOC 2 Type 2 compliant? If not please

comment what compliance level your datacenter facility meets.

3 Are the security policies and procedures routinely tested?

4Are exceptions to security policies and procedures justified and

documented?

Page 3 of 12 of 47

5 Are audit logs or other reporting mechanisms in place on all platforms?

6 Are errors and failures tracked?

7When an employee is found to in non-compliance with security policies,

has appropriate disciplinary action been taken?

8 Are audits performed on an annual basis?

9 Are unscheduled/surprise audits performed?

10 Has someone been identified as responsible for reconciling audits?

11Does either an internal or external auditor independently audit

Proposer’s operational controls on a periodic basis?

12Is an independent review carried out in order to assess the effective

implementation of security policies?

13

Can the Proposer provide evidence of having gone through a recent

audit of their organization’s operational policies, procedures, and

operating effectiveness, such as a SOC Type 2 report?

14Have outside audits been performed on internal operations? Please

provide copies.

15Has Proposer experienced a security breach of corporate or customer

data within the last 10 years?

16Is there is any concluded or pending litigation against the Proposer or an

employee related to a contract engagement or security breach?

17Does the Proposer subcontract services that will be required to fullfil

services as required in RSA's RFP.

18Does Proposer have a change management committee? Does it meet

on regularly scheduled intervals?

E. Application Development and Management

1 Has an application development methodology been implemented?

2Are appropriate/key application users involved with developing and

improving application methodology and implementation process?

3 Is pre-production testing performed in an isolated environment?

4 Has a promotion to production procedures been implemented?

5 Is there a legacy application management program?

6 Are secure coding standards implemented and are they followed?

Page 4 of 12 of 47

7Are applications testing for security vulnerabilities prior to being released

to production?

8Is there a dedicated security team for testing applications for

vulnerabilities?

9Are there procedures in place for protecting source code developed by

the Proposer (physically and electronically)?

10Is system access and security based on the concept of least possible

privilege and need-to-know?

11 Does Proposer perform source code reviews for each release?

12Are backdoors prevented from being placed into application source

code?

III Physical Security

A. Physical and Facilities

1 Is access to the building(s) controlled?

2 Is access to computing facilities controlled more so than to the building?

3 Is there an additional level of control for after-hours access?

4Is there an audit log to identify the individual and the time of access that

is monitored by a group other than Information Technology?

5 Are systems and other hardware adequately protected from theft?

6 Are procedures in place for proper disposal of confidential information?

7 Are proper fire suppression systems located in the facility?

8 Are facilities more than 5 miles from a government facility or airport?

9Are the servers and facilities that house software documentation and

programming logic located in a secure facility?

10

Is all confidential and restricted information marked as such and stored

in a secure area (room, cabinet) with access restricted to authorized

personnel only?

11

Does Proposer allow employees to work remote or in a virtual

environment? Please provide documentation around controls for

safeguarding computer systems and confidential data.

B. After-Hours Review

1 Are areas containing sensitive information properly secured?

2 Are workstation secured after-hours?

Page 5 of 12 of 47

3 Are keys and access cards properly secured?

4 Is confidential information properly secured?

5 Are contract cleaning crews activities monitored?

C. Incident Handling

1 Has an Incident Response Team (IRT) been established?

2 Have employees been trained as to when the IRT should be notified?

3 Has the IRT been trained in evidence gathering and handling?

4 Are incident reports issued to appropriate management?

5After an incident, are policies and procedures reviewed to determine if

modification need to be implemented?

6

Does the Proposer have a process in place to notify IT security of

breaches and/or problems so that proper notification and correction can

be done?

D. Contingency Planning

1Has a Business Impact Analysis been conducted on all systems,

applications, and platforms?

2Is there a documented data center Disaster Recovery Plan (DRP) in

place?

3 Are backup media password protected or encrypted?

4 Has the data center DRP been tested within the past 12 months?

5Are system, application, and data backups sent to a secure off-site

facility on a regular basis?

6Are Service Level Agreements that identify processing requirements in

place with all users and service providers?

7

Have departments, business units, groups, and other such entities

implemented business continuity plans that supplement the data center

DRP?

8 Have Emergency Response Procedures (ERP) been implemented?

9 Have ERPs been tested for effectiveness?

IV. Business Impact Analysis, Disaster Recovery Plan

A. General Review

Page 6 of 12 of 47

1

Backup planning includes identification of all critical data, programs,

documentation, and support items required performing essential task

during recovery?

2

The BIA is reviewed and updated regularly with special attention to new

technology, business changes, and migration of applications to

alternative platforms?

3Critical period timeframes have been identified for all applications and

systems?

4Senior management has reviewed and approved the prioritized list of

critical applications?

B. Disaster Recovery Plan (DRP)

1

A corporate disaster recovery plan coordinator has been named and a

mission statement identifying scope and responsibilities has been

published?

2A "worst-case" scenario DRP to recover normal operations within the

prescribed timeframes has been implemented and tested?

3

Listing of current emergency telephone numbers for police, fire

department, medical aid, and company officials are strategically located

throughput the facility and at off-site locations?

4The backup site is remote from hazards that endanger the main data

center?

5Contracts for outsourced activities have been amended to include

service providers' responsibilities for DRP?

6

Lead times for communication lines and equipment, specialized devices,

power hookups, construction, firewalls, computer configurations, and

LAN implementation have been factored into the DRP?

7At least one copy of the DRP is stored at the backup site and is updated

regularly?

8Automatic restart and recovery procedures are in place to restore data

files in the event of a processing failure?

9Contingency arrangements are in place for hardware, software,

communications, software, staff and supplies.

10

Customer software solutions that are being developed and\or in

production are backed up as part of the Proposer's backup and recovery

procedures?

Page 7 of 12 of 47

C. Testing

1 Backup and recovery procedures are tested at least annually?

2Training sessions are conducted for all relevant personnel on backup,

recovery, and contingency operating procedures?

3

Appropriate user representative have a particular role in creating and

reviewing control reliability and backup provisions for relevant

applications?4 Appropriate user representatives participate in the DRP tests?

Other Issues

1Provisions are in place to maintain the security of processing functions in

the event of an emergency?

2Insurance coverage for loss of hardware and business impact is in

place?

V. Technical Safeguards

A. Passwords

1Are host systems and servers as well as application servers secured with

unique passwords?

2 Are default accounts de-activated?

3 Are temporary user accounts restricted and disabled within 4 hours?

4Are the password management systems forcing users to change

passwords every 90 days or less?

5Are users of all company-provided network resources required to change

the initial default password?

6Are the passwords complex? Contain upper case, lower case, special

character or number, and at least 8 characters long.

7Do network and system administrators have adequate experience to

implement security standards?

8Are reports and logs pertaining to network users reviewed and reconciled

on a regular basis?

9 Are permissions being set securely?

10 Are administrators assigned a unique ID for access to critical systems?

11 Are administrators using appropriate tools to perform their jobs?

12 Does the application support multi-factor authentication?

Page 8 of 12 of 47

13 Are online systems always secured using SSL encryption?

B. Infrastructure

1 Is the network infrastructure audited on an annual basis?

2 Are network vulnerability assessments conducted on an annual basis?

3Are changes/improvements made in a timely fashion following network

vulnerability assessments?

4If you house or develop solutions around credit card transactions are you

CISP compliant?

C. Firewalls

1 Are protocols allowed to initiate connections from "outside" the firewall?

2Has a risk analysis been conducted to determine if the protocols allowed

maintain an acceptable level of risk?

3Has the firewall been tested to determine if outside penetration is

possible?

4 Are other products in place to augment the firewall level security?

5 Are the firewalls maintained and monitored 24x7?

6 Have services offered across the firewall been documented?

7Has a Demilitarized Zone (DMZ) or Perimeter Network been

implemented?

8 Has the firewall administrator been formally trained?

9 Is there more than one person administering the firewall?

10 Is the firewall for the ASP separate from the corporate firewall?

D. Data Communications

1 Is there a remote access procedure in place?

2 Is there a current network diagram?

3 Are Access Control List (ACLs) maintained on a regular basis?

4 Is the network environment partitioned?

5 Are the corporate routers separated from the ASP routers?

6 Are the corporate switches separated from the ASP switches?

7Does the communication equipment log administrative access to the

systems?

8 Is SNMP data collected from the data communication devices?

9 Is syslog data collected from the data communication devices?

10 Are there standard templates for configuring routers?

Page 9 of 12 of 47

11 Are there standard templates for configuring switches?

E. Databases

1 Are default database passwords changed?

2 Are database administrators trained or certified?

3 Are database backups performed daily?

F. Computing Platforms

1 Are critical servers protected with appropriate access controls?

2Are development staff administrators on their computers used for writing

source code?

3 Is there a company image used for corporate PCs and laptops?

4Does the company have an asset management system to track software

installed?

5Is there an anti-virus application installed on all PC's, laptops, and

servers?

6Does the anti-virus application automatically update computing assets 3

times or more per day?

7 Is there a URL filtering solution in place?

8Do computing assets have a corporate anti-malware application

installed?

9Are Internet facing servers protected with host based intrusion

prevention?

10Are employees restricted to what can be installed on their computer

systems? How is this managed for remote employees if applicable?

11

Do any of the Proposer's computer systems including storage reside on

a cloud computing environment? Is it owned and operated by the

Proposer? If no, please explain.

G. Intrusion Prevention

1Is host based intrusion prevention software installed on all Internet facing

servers?

2 Are network based intrusion prevention systems in-line and defending?

3 Is host based intrusion prevention software installed on all laptops?

4Is there a dedicated security staff monitoring 24x7 alerts from the host

based intrusion prevention?

Page 10 of 12 of 47

5Is there a dedicated security staff monitoring 24x7 alerts from the

network based intrusion prevention?

VI. Telecommunications Security

A. Policy

1Is there a published policy on the use of organizational

telecommunications resources?

2Have all employees have been made aware of the telecommunications

policy?

3

Employees authorized for Internet access are made aware of the

organization's proprietary information and what they can discuss in open

forums?

4Employees using cellular or wireless phones are briefed on the lack of

privacy of conversations when using unsecured versions of technology?

5

The organization has a published policy on prosecution of employees

and outsiders if found guilty of serious premeditated criminal acts against

the organization?

6

Are corporate devices such as iPhones or Android based phones

centrally managed by the Proposer to control rogue software installations

and protect corporate data?

B. Standards

1A threshold is established to monitor and suspend repeated

unsuccessful dial-in or remote access attempts?

2Access to databases reachable via dial-in or VPN have access control in

place to prevent unauthorized access?

3Financial applications available via dial-in or VPN have audit trails

established to track access and transaction usage?

4 Are audit trails reviewed and corrective action taken on a regular basis?

5When possible are acl security programs used to control dial-in or

remote access to a specific application?

6Company proprietary data, stored on portable computers are secured

from unauthorized access?

7Are corproate emails allowed to be sent from unique domains not one

used by Proposer such as Gmail or Microsoft Email?

Page 11 of 12 of 47

8Users of all company-provided communication systems are required to

change the default or initial password?

C. Practices

1Security, application, and network personnel actively work to ensure

control inconvenience is as minimal as possible?

2Personnel independent of the operations staff and security

administration review tamper-resistant logs and audit trails?

3Special procedures and audited userIDs have been established for

application, system, network troubleshooting activities?

4

Messages and transactions coming in via phone lines are serially

numbered, time stamped, and logged for audit investigation and backup

purposes?

5Employees are made aware of their responsibility to keep remote access

codes secure from unauthorized access and usage?

6Removal of portable computers from the corporate locations must be

done through normal property removal procedures?

7Employees are briefed on their responsibility to protect the property of

the company when working away from the corporate environment?

VII. Company Information

A. Public Information

1 Is the company publicly traded?

2 Is the company bonded?

3 Are all employees in the continental US? If not please list.

B. Private Information

1 Are there any planned acquisitions in the next 12 months?

2 Are there current plans to sell the company in the next 12 months?

Page 12 of 12 of 47

Form W-9 (Rev. October 2018) Department of the Treasury Internal Revenue Service

Request for Taxpayer Identification Number and Certification

▶ Go to www.irs.gov/FormW9 for instructions and the latest information.

Give Form to the

requester. Do not

send to the IRS.

1 Name (as shown on your income tax return). Name is required on this line; do not leave this line blank.

2 Business name/disregarded entity name, if different from above

3 Check appropriate box for federal tax classification of the person whose name is entered on line 1. Check only one of the

following seven boxes.

4 Exemptions (codes apply only to certain entities, not individuals; see instructions on page 3):

Individual/sole proprietor or single-member LLC

C Corporation S Corporation Partnership Trust/estate

Exempt payee code (if any)

Limited liability company. Enter the tax classification (C=C corporation, S=S corporation, P=Partnership) ▶

Note: Check the appropriate box in the line above for the tax classification of the single-member owner. Do not check LLC if the LLC is classified as a single-member LLC that is disregarded from the owner unless the owner of the LLC is another LLC that is not disregarded from the owner for U.S. federal tax purposes. Otherwise, a single-member LLC that is disregarded from the owner should check the appropriate box for the tax classification of its owner.

Other (see instructions) ▶

Exemption from FATCA reporting

code (if any)

(Applies to accounts maintained outside the U.S.)

5 Address (number, street, and apt. or suite no.) See instructions. Requester’s name and address (optional)

6 City, state, and ZIP code

7 List account number(s) here (optional)

Part I Taxpayer Identification Number (TIN) Enter your TIN in the appropriate box. The TIN provided must match the name given on line 1 to avoid backup withholding. For individuals, this is generally your social security number (SSN). However, for a resident alien, sole proprietor, or disregarded entity, see the instructions for Part I, later. For other entities, it is your employer identification number (EIN). If you do not have a number, see How to get a TIN, later.

Note: If the account is in more than one name, see the instructions for line 1. Also see What Name and Number To Give the Requester for guidelines on whose number to enter.

Part II Certification Under penalties of perjury, I certify that:

Social security number

– –

or Employer identification number

–

1. The number shown on this form is my correct taxpayer identification number (or I am waiting for a number to be issued to me); and

2. I am not subject to backup withholding because: (a) I am exempt from backup withholding, or (b) I have not been notified by the Internal Revenue Service (IRS) that I am subject to backup withholding as a result of a failure to report all interest or dividends, or (c) the IRS has notified me that I am no longer subject to backup withholding; and

3. I am a U.S. citizen or other U.S. person (defined below); and

4. The FATCA code(s) entered on this form (if any) indicating that I am exempt from FATCA reporting is correct.

Certification instructions. You must cross out item 2 above if you have been notified by the IRS that you are currently subject to backup withholding because you have failed to report all interest and dividends on your tax return. For real estate transactions, item 2 does not apply. For mortgage interest paid, acquisition or abandonment of secured property, cancellation of debt, contributions to an individual retirement arrangement (IRA), and generally, payments other than interest and dividends, you are not required to sign the certification, but you must provide your correct TIN. See the instructions for Part II, later.

General Instructions Section references are to the Internal Revenue Code unless otherwise noted.

Future developments. For the latest information about developments related to Form W-9 and its instructions, such as legislation enacted after they were published, go to www.irs.gov/FormW9.

Purpose of Form An individual or entity (Form W-9 requester) who is required to file an information return with the IRS must obtain your correct taxpayer identification number (TIN) which may be your social security number (SSN), individual taxpayer identification number (ITIN), adoption taxpayer identification number (ATIN), or employer identification number (EIN), to report on an information return the amount paid to you, or other amount reportable on an information return. Examples of information returns include, but are not limited to, the following.

• Form 1099-INT (interest earned or paid)

• Form 1099-DIV (dividends, including those from stocks or mutual funds)

• Form 1099-MISC (various types of income, prizes, awards, or gross proceeds)

• Form 1099-B (stock or mutual fund sales and certain other transactions by brokers)

• Form 1099-S (proceeds from real estate transactions)

• Form 1099-K (merchant card and third party network transactions)

• Form 1098 (home mortgage interest), 1098-E (student loan interest), 1098-T (tuition)

• Form 1099-C (canceled debt)

• Form 1099-A (acquisition or abandonment of secured property)

Use Form W-9 only if you are a U.S. person (including a resident alien), to provide your correct TIN.

If you do not return Form W-9 to the requester with a TIN, you might be subject to backup withholding. See What is backup withholding, later.

Cat. No. 10231X Form W-9 (Rev. 10-2018)

Sign Here

Signature of

U.S. person ▶ Date ▶

Pri

nt

or

typ

e.

Se

e S

pe

cif

ic I

nstr

ucti

on

s o

n p

age 3

.

of 47

http://www.irs.gov/FormW9

http://www.irs.gov/FormW9

Form W-9 (Rev. 10-2018)

By signing the filled-out form, you:

1. Certify that the TIN you are giving is correct (or you are waiting for a number to be issued),

2. Certify that you are not subject to backup withholding, or

3. Claim exemption from backup withholding if you are a U.S. exempt payee. If applicable, you are also certifying that as a U.S. person, your allocable share of any partnership income from a U.S. trade or business is not subject to the withholding tax on foreign partners' share of effectively connected income, and

4. Certify that FATCA code(s) entered on this form (if any) indicating that you are exempt from the FATCA reporting, is correct. See What is FATCA reporting, later, for further information.

Note: If you are a U.S. person and a requester gives you a form other than Form W-9 to request your TIN, you must use the requester’s form if it is substantially similar to this Form W-9.

Definition of a U.S. person. For federal tax purposes, you are considered a U.S. person if you are:

• An individual who is a U.S. citizen or U.S. resident alien;

• A partnership, corporation, company, or association created or organized in the United States or under the laws of the United States;

• An estate (other than a foreign estate); or

• A domestic trust (as defined in Regulations section 301.7701-7).

Special rules for partnerships. Partnerships that conduct a trade or business in the United States are generally required to pay a withholding tax under section 1446 on any foreign partners’ share of effectively connected taxable income from such business. Further, in certain cases where a Form W-9 has not been received, the rules under section 1446 require a partnership to presume that a partner is a foreign person, and pay the section 1446 withholding tax. Therefore, if you are a U.S. person that is a partner in a partnership conducting a trade or business in the United States, provide Form W-9 to the partnership to establish your U.S. status and avoid section 1446 withholding on your share of partnership income.

In the cases below, the following person must give Form W-9 to the partnership for purposes of establishing its U.S. status and avoiding withholding on its allocable share of net income from the partnership conducting a trade or business in the United States.

• In the case of a disregarded entity with a U.S. owner, the U.S. owner of the disregarded entity and not the entity;

• In the case of a grantor trust with a U.S. grantor or other U.S. owner, generally, the U.S. grantor or other U.S. owner of the grantor trust and not the trust; and

• In the case of a U.S. trust (other than a grantor trust), the U.S. trust (other than a grantor trust) and not the beneficiaries of the trust.

Foreign person. If you are a foreign person or the U.S. branch of a foreign bank that has elected to be treated as a U.S. person, do not use Form W-9. Instead, use the appropriate Form W-8 or Form 8233 (see Pub. 515, Withholding of Tax on Nonresident Aliens and Foreign Entities).

Nonresident alien who becomes a resident alien. Generally, only a nonresident alien individual may use the terms of a tax treaty to reduce or eliminate U.S. tax on certain types of income. However, most tax treaties contain a provision known as a “saving clause.” Exceptions specified in the saving clause may permit an exemption from tax to continue for certain types of income even after the payee has otherwise become a U.S. resident alien for tax purposes.

If you are a U.S. resident alien who is relying on an exception contained in the saving clause of a tax treaty to claim an exemption from U.S. tax on certain types of income, you must attach a statement to Form W-9 that specifies the following five items.

1. The treaty country. Generally, this must be the same treaty under which you claimed exemption from tax as a nonresident alien.

2. The treaty article addressing the income.

3. The article number (or location) in the tax treaty that contains the saving clause and its exceptions.

4. The type and amount of income that qualifies for the exemption from tax.

5. Sufficient facts to justify the exemption from tax under the terms of the treaty article.

Example. Article 20 of the U.S.-China income tax treaty allows an exemption from tax for scholarship income received by a Chinese student temporarily present in the United States. Under U.S. law, this student will become a resident alien for tax purposes if his or her stay in the United States exceeds 5 calendar years. However, paragraph 2 of the first Protocol to the U.S.-China treaty (dated April 30, 1984) allows the provisions of Article 20 to continue to apply even after the Chinese student becomes a resident alien of the United States. A Chinese student who qualifies for this exception (under paragraph 2 of the first protocol) and is relying on this exception to claim an exemption from tax on his or her scholarship or fellowship income would attach to Form W-9 a statement that includes the information described above to support that exemption.

If you are a nonresident alien or a foreign entity, give the requester the appropriate completed Form W-8 or Form 8233.

Backup Withholding What is backup withholding? Persons making certain payments to you must under certain conditions withhold and pay to the IRS 24% of such payments. This is called “backup withholding.” Payments that may be subject to backup withholding include interest, tax-exempt interest, dividends, broker and barter exchange transactions, rents, royalties, nonemployee pay, payments made in settlement of payment card and third party network transactions, and certain payments from fishing boat operators. Real estate transactions are not subject to backup withholding.

You will not be subject to backup withholding on payments you receive if you give the requester your correct TIN, make the proper certifications, and report all your taxable interest and dividends on your tax return.

Payments you receive will be subject to backup withholding if:

1. You do not furnish your TIN to the requester,

2. You do not certify your TIN when required (see the instructions for Part II for details),

3. The IRS tells the requester that you furnished an incorrect TIN,

4. The IRS tells you that you are subject to backup withholding because you did not report all your interest and dividends on your tax return (for reportable interest and dividends only), or

5. You do not certify to the requester that you are not subject to backup withholding under 4 above (for reportable interest and dividend accounts opened after 1983 only).

Certain payees and payments are exempt from backup withholding. See Exempt payee code, later, and the separate Instructions for the Requester of Form W-9 for more information.

Also see Special rules for partnerships, earlier.

What is FATCA Reporting? The Foreign Account Tax Compliance Act (FATCA) requires a participating foreign financial institution to report all United States account holders that are specified United States persons. Certain payees are exempt from FATCA reporting. See Exemption from FATCA reporting code, later, and the Instructions for the Requester of Form W-9 for more information.

Updating Your Information You must provide updated information to any person to whom you claimed to be an exempt payee if you are no longer an exempt payee and anticipate receiving reportable payments in the future from this person. For example, you may need to provide updated information if you are a C corporation that elects to be an S corporation, or if you no longer are tax exempt. In addition, you must furnish a new Form W-9 if the name or TIN changes for the account; for example, if the grantor of a grantor trust dies.

Penalties Failure to furnish TIN. If you fail to furnish your correct TIN to a requester, you are subject to a penalty of $50 for each such failure unless your failure is due to reasonable cause and not to willful neglect.

Civil penalty for false information with respect to withholding. If you make a false statement with no reasonable basis that results in no backup withholding, you are subject to a $500 penalty.

of 47

Form W-9 (Rev. 10-2018)

Criminal penalty for falsifying information. Willfully falsifying certifications or affirmations may subject you to criminal penalties including fines and/or imprisonment.

Misuse of TINs. If the requester discloses or uses TINs in violation of federal law, the requester may be subject to civil and criminal penalties.

Specific Instructions

Line 1

You must enter one of the following on this line; do not leave this line blank. The name should match the name on your tax return.

If this Form W-9 is for a joint account (other than an account maintained by a foreign financial institution (FFI)), list first, and then circle, the name of the person or entity whose number you entered in Part I of Form W-9. If you are providing Form W-9 to an FFI to document a joint account, each holder of the account that is a U.S. person must provide a Form W-9.

a. Individual. Generally, enter the name shown on your tax return. If you have changed your last name without informing the Social Security Administration (SSA) of the name change, enter your first name, the last name as shown on your social security card, and your new last name.

Note: ITIN applicant: Enter your individual name as it was entered on your Form W-7 application, line 1a. This should also be the same as the name you entered on the Form 1040/1040A/1040EZ you filed with your application.

b. Sole proprietor or single-member LLC. Enter your individual name as shown on your 1040/1040A/1040EZ on line 1. You may enter your business, trade, or “doing business as” (DBA) name on line 2.

c. Partnership, LLC that is not a single-member LLC, C corporation, or S corporation. Enter the entity's name as shown on the entity's tax return on line 1 and any business, trade, or DBA name on line 2.

d. Other entities. Enter your name as shown on required U.S. federal tax documents on line 1. This name should match the name shown on the charter or other legal document creating the entity. You may enter any business, trade, or DBA name on line 2.

e. Disregarded entity. For U.S. federal tax purposes, an entity that is disregarded as an entity separate from its owner is treated as a “disregarded entity.” See Regulations section 301.7701-2(c)(2)(iii). Enter the owner's name on line 1. The name of the entity entered on line 1 should never be a disregarded entity. The name on line 1 should be the name shown on the income tax return on which the income should be reported. For example, if a foreign LLC that is treated as a disregarded entity for U.S. federal tax purposes has a single owner that is a U.S. person, the U.S. owner's name is required to be provided on line 1. If the direct owner of the entity is also a disregarded entity, enter the first owner that is not disregarded for federal tax purposes. Enter the disregarded entity's name on line 2, “Business name/disregarded entity name.” If the owner of the disregarded entity is a foreign person, the owner must complete an appropriate Form W-8 instead of a Form W-9. This is the case even if the foreign person has a U.S. TIN.

Line 2

If you have a business name, trade name, DBA name, or disregarded entity name, you may enter it on line 2.

Line 3

Check the appropriate box on line 3 for the U.S. federal tax classification of the person whose name is entered on line 1. Check only one box on line 3.

IF the entity/person on line 1 is a(n) . . .

THEN check the box for . . .

• Corporation Corporation

• Individual

• Sole proprietorship, or

• Single-member limited liability company (LLC) owned by an individual and disregarded for U.S. federal tax purposes.

Individual/sole proprietor or single- member LLC

• LLC treated as a partnership for U.S. federal tax purposes,

• LLC that has filed Form 8832 or 2553 to be taxed as a corporation, or

• LLC that is disregarded as an entity separate from its owner but the owner is another LLC that is not disregarded for U.S. federal tax purposes.

Limited liability company and enter the appropriate tax classification. (P= Partnership; C= C corporation; or S= S corporation)

• Partnership Partnership

• Trust/estate Trust/estate

Line 4, Exemptions

If you are exempt from backup withholding and/or FATCA reporting, enter in the appropriate space on line 4 any code(s) that may apply to you.

Exempt payee code.

• Generally, individuals (including sole proprietors) are not exempt from backup withholding.

• Except as provided below, corporations are exempt from backup withholding for certain payments, including interest and dividends.

• Corporations are not exempt from backup withholding for payments made in settlement of payment card or third party network transactions.

• Corporations are not exempt from backup withholding with respect to attorneys’ fees or gross proceeds paid to attorneys, and corporations that provide medical or health care services are not exempt with respect to payments reportable on Form 1099-MISC.

The following codes identify payees that are exempt from backup withholding. Enter the appropriate code in the space in line 4.

1—An organization exempt from tax under section 501(a), any IRA, or a custodial account under section 403(b)(7) if the account satisfies the requirements of section 401(f)(2)

2—The United States or any of its agencies or instrumentalities

3—A state, the District of Columbia, a U.S. commonwealth or possession, or any of their political subdivisions or instrumentalities

4—A foreign government or any of its political subdivisions, agencies, or instrumentalities

5—A corporation

6—A dealer in securities or commodities required to register in the United States, the District of Columbia, or a U.S. commonwealth or possession

7—A futures commission merchant registered with the Commodity Futures Trading Commission

8—A real estate investment trust

9—An entity registered at all times during the tax year under the Investment Company Act of 1940

10—A common trust fund operated by a bank under section 584(a)

11—A financial institution

12—A middleman known in the investment community as a nominee or custodian

13—A trust exempt from tax under section 664 or described in section 4947

of 47

Form W-9 (Rev. 10-2018)

The following chart shows types of payments that may be exempt from backup withholding. The chart applies to the exempt payees listed above, 1 through 13.

IF the payment is for . . . THEN the payment is exempt for . . .

Interest and dividend payments All exempt payees except for 7

Broker transactions Exempt payees 1 through 4 and 6 through 11 and all C corporations. S corporations must not enter an exempt payee code because they are exempt only for sales of noncovered securities acquired prior to 2012.

Barter exchange transactions and patronage dividends

Exempt payees 1 through 4

Payments over $600 required to be reported and direct sales over

$5,0001

Generally, exempt payees

1 through 52

Payments made in settlement of payment card or third party network transactions

Exempt payees 1 through 4

1 See Form 1099-MISC, Miscellaneous Income, and its instructions.

2 However, the following payments made to a corporation and reportable on Form 1099-MISC are not exempt from backup withholding: medical and health care payments, attorneys’ fees, gross proceeds paid to an attorney reportable under section 6045(f), and payments for services paid by a federal executive agency.

Exemption from FATCA reporting code. The following codes identify payees that are exempt from reporting under FATCA. These codes apply to persons submitting this form for accounts maintained outside of the United States by certain foreign financial institutions. Therefore, if you are only submitting this form for an account you hold in the United States, you may leave this field blank. Consult with the person requesting this form if you are uncertain if the financial institution is subject to these requirements. A requester may indicate that a code is not required by providing you with a Form W-9 with “Not Applicable” (or any similar indication) written or printed on the line for a FATCA exemption code.

A—An organization exempt from tax under section 501(a) or any individual retirement plan as defined in section 7701(a)(37)

B—The United States or any of its agencies or instrumentalities C—

A state, the District of Columbia, a U.S. commonwealth or possession, or any of their political subdivisions or instrumentalities

D—A corporation the stock of which is regularly traded on one or more established securities markets, as described in Regulations section 1.1472-1(c)(1)(i)

E—A corporation that is a member of the same expanded affiliated group as a corporation described in Regulations section 1.1472-1(c)(1)(i)

F—A dealer in securities, commodities, or derivative financial instruments (including notional principal contracts, futures, forwards, and options) that is registered as such under the laws of the United States or any state

G—A real estate investment trust

H—A regulated investment company as defined in section 851 or an entity registered at all times during the tax year under the Investment Company Act of 1940

I—A common trust fund as defined in section 584(a) J—

A bank as defined in section 581

K—A broker

L—A trust exempt from tax under section 664 or described in section 4947(a)(1)

M—A tax exempt trust under a section 403(b) plan or section 457(g) plan

Note: You may wish to consult with the financial institution requesting this form to determine whether the FATCA code and/or exempt payee code should be completed.

Line 5

Enter your address (number, street, and apartment or suite number). This is where the requester of this Form W-9 will mail your information returns. If this address differs from the one the requester already has on file, write NEW at the top. If a new address is provided, there is still a chance the old address will be used until the payor changes your address in their records.

Line 6

Enter your city, state, and ZIP code.

Part I. Taxpayer Identification Number (TIN) Enter your TIN in the appropriate box. If you are a resident alien and you do not have and are not eligible to get an SSN, your TIN is your IRS individual taxpayer identification number (ITIN). Enter it in the social security number box. If you do not have an ITIN, see How to get a TIN below.

If you are a sole proprietor and you have an EIN, you may enter either your SSN or EIN.

If you are a single-member LLC that is disregarded as an entity separate from its owner, enter the owner’s SSN (or EIN, if the owner has one). Do not enter the disregarded entity’s EIN. If the LLC is classified as a corporation or partnership, enter the entity’s EIN.

Note: See What Name and Number To Give the Requester, later, for further clarification of name and TIN combinations.

How to get a TIN. If you do not have a TIN, apply for one immediately. To apply for an SSN, get Form SS-5, Application for a Social Security Card, from your local SSA office or get this form online at www.SSA.gov. You may also get this form by calling 1-800-772-1213. Use Form W-7, Application for IRS Individual Taxpayer Identification Number, to apply for an ITIN, or Form SS-4, Application for Employer Identification Number, to apply for an EIN. You can apply for an EIN online by accessing the IRS website at www.irs.gov/Businesses and clicking on Employer Identification Number (EIN) under Starting a Business. Go to www.irs.gov/Forms to view, download, or print Form W-7 and/or Form SS-4. Or, you can go to www.irs.gov/OrderForms to place an order and have Form W-7 and/or SS-4 mailed to you within 10 business days.

If you are asked to complete Form W-9 but do not have a TIN, apply for a TIN and write “Applied For” in the space for the TIN, sign and date the form, and give it to the requester. For interest and dividend payments, and certain payments made with respect to readily tradable instruments, generally you will have 60 days to get a TIN and give it to the requester before you are subject to backup withholding on payments. The 60-day rule does not apply to other types of payments. You will be subject to backup withholding on all such payments until you provide your TIN to the requester.

Note: Entering “Applied For” means that you have already applied for a TIN or that you intend to apply for one soon.

Caution: A disregarded U.S. entity that has a foreign owner must use the appropriate Form W-8.

Part II. Certification To establish to the withholding agent that you are a U.S. person, or resident alien, sign Form W-9. You may be requested to sign by the withholding agent even if item 1, 4, or 5 below indicates otherwise.

For a joint account, only the person whose TIN is shown in Part I should sign (when required). In the case of a disregarded entity, the person identified on line 1 must sign. Exempt payees, see Exempt payee code, earlier.

Signature requirements. Complete the certification as indicated in items 1 through 5 below.

of 47

http://www.ssa.gov/

http://www.irs.gov/Businesses

http://www.irs.gov/Forms

http://www.irs.gov/OrderForms

Form W-9 (Rev. 10-2018)

1. Interest, dividend, and barter exchange accounts opened before 1984 and broker accounts considered active during 1983. You must give your correct TIN, but you do not have to sign the certification.

2. Interest, dividend, broker, and barter exchange accounts opened after 1983 and broker accounts considered inactive during 1983. You must sign the certification or backup withholding will apply. If you are subject to backup withholding and you are merely providing your correct TIN to the requester, you must cross out item 2 in the certification before signing the form.

3. Real estate transactions. You must sign the certification. You may cross out item 2 of the certification.

4. Other payments. You must give your correct TIN, but you do not have to sign the certification unless you have been notified that you have previously given an incorrect TIN. “Other payments” include payments made in the course of the requester’s trade or business for rents, royalties, goods (other than bills for merchandise), medical and health care services (including payments to corporations), payments to a nonemployee for services, payments made in settlement of payment card and third party network transactions, payments to certain fishing boat crew members and fishermen, and gross proceeds paid to attorneys (including payments to corporations).

5. Mortgage interest paid by you, acquisition or abandonment of secured property, cancellation of debt, qualified tuition program payments (under section 529), ABLE accounts (under section 529A), IRA, Coverdell ESA, Archer MSA or HSA contributions or distributions, and pension distributions. You must give your correct TIN, but you do not have to sign the certification.

What Name and Number To Give the Requester

For this type of account: Give name and EIN of:

14. Account with the Department of

Agriculture in the name of a public

entity (such as a state or local

government, school district, or

prison) that receives agricultural

program payments

The public entity

15. Grantor trust filing under the Form

1041 Filing Method or the Optional

Form 1099 Filing Method 2 (see

Regulations section 1.671-4(b)(2)(i)(B))

The trust

1 List first and circle the name of the person whose number you furnish. If only one person on a joint account has an SSN, that person’s number must be furnished.

2 Circle the minor’s name and furnish the minor’s SSN.

3 You must show your individual name and you may also enter your business or DBA name on the “Business name/disregarded entity” name line. You may use either your SSN or EIN (if you have one), but the IRS encourages you to use your SSN.

4 List first and circle the name of the trust, estate, or pension trust. (Do not furnish the TIN of the personal representative or trustee unless the legal entity itself is not designated in the account title.) Also see Special rules for partnerships, earlier.

*Note: The grantor also must provide a Form W-9 to trustee of trust.

Note: If no name is circled when more than one name is listed, the number will be considered to be that of the first name listed.

Secure Your Tax Records From Identity Theft Identity theft occurs when someone uses your personal information such as your name, SSN, or other identifying information, without your permission, to commit fraud or other crimes. An identity thief may use your SSN to get a job or may file a tax return using your SSN to receive a refund.

To reduce your risk:

• Protect your SSN,

• Ensure your employer is protecting your SSN, and

• Be careful when choosing a tax preparer.

If your tax records are affected by identity theft and you receive a notice from the IRS, respond right away to the name and phone number printed on the IRS notice or letter.

If your tax records are not currently affected by identity theft but you think you are at risk due to a lost or stolen purse or wallet, questionable credit card activity or credit report, contact the IRS Identity Theft Hotline at 1-800-908-4490 or submit Form 14039.

For more information, see Pub. 5027, Identity Theft Information for Taxpayers.

Victims of identity theft who are experiencing economic harm or a systemic problem, or are seeking help in resolving tax problems that have not been resolved through normal channels, may be eligible for Taxpayer Advocate Service (TAS) assistance. You can reach TAS by calling the TAS toll-free case intake line at 1-877-777-4778 or TTY/TDD 1-800-829-4059.

Protect yourself from suspicious emails or phishing schemes. Phishing is the creation and use of email and websites designed to mimic legitimate business emails and websites. The most common act is sending an email to a user falsely claiming to be an established legitimate enterprise in an attempt to scam the user into surrendering private information that will be used for identity theft.

For this type of account: Give name and SSN of:

1. Individual The individual

2. Two or more individuals (joint

account) other than an account

maintained by an FFI

The actual owner of the account or, if

combined funds, the first individual on

the account1

3. Two or more U.S. persons

(joint account maintained by an FFI) Each holder of the account

4. Custodial account of a minor

(Uniform Gift to Minors Act)

The minor2

5. a. The usual revocable savings trust

(grantor is also trustee)

b. So-called trust account that is not

a legal or valid trust under state law

The grantor-trustee1

The actual owner1

6. Sole proprietorship or disregarded

entity owned by an individual The owner

3

7. Grantor trust filing under Optional

Form 1099 Filing Method 1 (see

Regulations section 1.671-4(b)(2)(i)

(A))

The grantor*

For this type of account: Give name and EIN of:

8. Disregarded entity not owned by an

individual

The owner

9. A valid trust, estate, or pension trust Legal entity4

10. Corporation or LLC electing

corporate status on Form 8832 or

Form 2553

The corporation

11. Association, club, religious,

charitable, educational, or other tax-

exempt organization

The organization

12. Partnership or multi-member LLC The partnership

13. A broker or registered nominee The broker or nominee

of 47

Form W-9 (Rev. 10-2018)

The IRS does not initiate contacts with taxpayers via emails. Also, the IRS does not request personal detailed information through email or ask taxpayers for the PIN numbers, passwords, or similar secret access information for their credit card, bank, or other financial accounts.

If you receive an unsolicited email claiming to be from the IRS, forward this message to [email protected]. You may also report misuse of the IRS name, logo, or other IRS property to the Treasury Inspector General for Tax Administration (TIGTA) at 1-800-366-4484. You can forward suspicious emails to the Federal Trade Commission at [email protected] or report them at www.ftc.gov/complaint. You can contact the FTC at www.ftc.gov/idtheft or 877-IDTHEFT (877-438-4338). If you have been the victim of identity theft, see www.IdentityTheft.gov and Pub. 5027.

Visit www.irs.gov/IdentityTheft to learn more about identity theft and how to reduce your risk.

Privacy Act Notice Section 6109 of the Internal Revenue Code requires you to provide your correct TIN to persons (including federal agencies) who are required to file information returns with the IRS to report interest, dividends, or certain other income paid to you; mortgage interest you paid; the acquisition or abandonment of secured property; the cancellation of debt; or contributions you made to an IRA, Archer MSA, or HSA. The person collecting this form uses the information on the form to file information returns with the IRS, reporting the above information. Routine uses of this information include giving it to the Department of Justice for civil and criminal litigation and to cities, states, the District of Columbia, and U.S. commonwealths and possessions for use in administering their laws. The information also may be disclosed to other countries under a treaty, to federal and state agencies to enforce civil and criminal laws, or to federal law enforcement and intelligence agencies to combat terrorism. You must provide your TIN whether or not you are required to file a tax return. Under section 3406, payers must generally withhold a percentage of taxable interest, dividend, and certain other payments to a payee who does not give a TIN to the payer. Certain penalties may also apply for providing false or fraudulent information.

of 47



http://www.ftc.gov/complaint

http://www.ftc.gov/idtheft

http://www.identitytheft.gov/

http://www.irs.gov/IdentityTheft


Confidentiality and Non-Disclosure Agreement

This Agreement is entered into this ___ day of ________, 201__ by and between ______________________ with offices at _____________________ (hereinafter "Recipient") and the Retirement Systems of Alabama, headquartered in Montgomery, Alabama (hereinafter "RSA").

WHEREAS RSA possesses information that is confidential and proprietary to RSA (hereinafter "Confidential Information"); and

WHEREAS the Recipient is willing to receive disclosure of the Confidential Information pursuant to the terms of this Agreement for the purpose of _______________________;

NOW THEREFORE, in consideration for the mutual undertakings of the RSA and the Recipient under this Agreement, the parties agree as follows:

1. Disclosure. RSA agrees to disclose, and Recipient agrees to receive the Confidential Information.

2. Confidentiality.

2.1 No Use. Recipient agrees not to use the Confidential Information in any way except for the purpose set forth above.

2.2 No Disclosure. Recipient agrees to use its best efforts to prevent and protect the Confidential Information, or any part thereof, from disclosure to any person other than Recipient's employees having a need for disclosure in connection with Recipient's authorized use of the Confidential Information.

2.3 Protection of Secrecy. Recipient agrees to take all steps reasonably necessary to protect the secrecy of the Confidential Information, and to prevent the Confidential Information from falling into the public domain or into the possession of unauthorized persons.

3. Limits on Confidential Information. Confidential Information shall not be deemed proprietary and the Recipient shall have no obligation with respect to such information where the information:

(a) was known to Recipient prior to receiving any of the Confidential Information from RSA;

(b) has become publicly known through no wrongful act of Recipient;

(c) was received by Recipient without breach of this Agreement from a third party without restriction as to the use and disclosure of the information;

(d) was independently developed by Recipient without use of the Confidential Information; or

(e) was ordered to be publicly released by the requirement of a government agency.

4. Ownership of Confidential Information. Recipient agrees that all Confidential Information shall remain the property of RSA, and that RSA may use such Confidential Information for any purpose without obligation to Recipient. Nothing contained herein shall be construed as

of 47


Confidentiality and Non-Disclosure Agreement

granting or implying any transfer of rights to Recipient in the Confidential Information, or any patents or other intellectual property protecting or relating to the Confidential Information.

5. Recipient agrees to not store or house confidential information, such as but not limited to social security numbers or PHI on company or employee owned servers, networks, external storage media, or any other form of peripheral device capable of storing data, without the explicit written permission of RSA.

6. Term and Termination. The obligations of this Agreement shall be continuing until the Confidential Information disclosed to Recipient is no longer confidential. This agreement shall continue in the event the above stated purpose service agreement is ended for any reason.

7. Survival of Rights and Obligations. This Agreement shall be binding upon, inure to the benefit of, and be enforceable by (a) RSA, its successors, and assigns; and (b) Recipient, its successors and assigns.

8. Recipient agrees to notify RSA immediately and no later than 24 hours if Confidential Information has to been disclosed to a party other than the named Recipient.

IN WITNESS WHEREOF, the parties have executed this agreement effective as of the date first written above.

Retirement Systems Of Alabama RECIPIENT (_____________________)

Signed: ______________________________ Print Name: ___________________________ Title: ________________________________ Date: ________________________________

Signed: ______________________________ Print Name: ___________________________ Title: ________________________________ Date: ________________________________

of 47